Three Fortinet Flaws Exploited, One Patched Last Week

iRhythm Holdings, a digital health company that makes wearable cardiac monitoring patches, has disclosed a data breach after attackers broke into third-party-hosted business applications and made off with patient personal and health information. According to a filing with the U.S. Securities and Exchange Commission, the company discovered the intrusion on June 15 — one day after receiving a ransom demand from the attackers, who had first made contact on June 9 threatening to publish the stolen data online. iRhythm has not attributed the attack to a specific threat actor or extortion group.

The scale of the potential exposure is significant. iRhythm's cardiac monitoring service has processed data from over 12 million patients, representing more than 2 billion hours of heartbeat recordings. The company has not confirmed exactly how many patients are affected or precisely what data was taken, but the attackers claim it includes sensitive proprietary and patient information.

iRhythm says external cybersecurity experts are now involved and its incident response plan has been activated.

What you should do: If you have ever used an iRhythm cardiac monitoring device, watch for a notification letter from the company. Be alert to phishing attempts (scam messages designed to look like official communications) using your health information as bait — attackers who hold medical data often use it to make follow-up scams appear more convincing. Do not respond to any unsolicited contact claiming to be from iRhythm until you have verified it through their official website.

A ransomware operation called DragonForce has found a way to disguise its command-and-control traffic — the communications channel between attackers and malware on a victim's machine — inside Microsoft Teams' own relay infrastructure.

Their custom malware, Backdoor.Turn, abuses the TURN protocol (a networking standard Teams uses to route messages when a direct connection isn't possible) by obtaining an anonymous Teams visitor token and routing attacker traffic through Microsoft's own legitimate relay servers. To a defender watching network traffic, it looks like ordinary Teams activity.

The technique was used in an attack against a major US services company, according to researchers at Symantec. The implication for defenders is serious: traffic filtering tools that trust Microsoft infrastructure by default may not catch this. Security teams should not treat Teams-associated traffic as inherently safe.

What FortiSandbox is: FortiSandbox is a cybersecurity product made by Fortinet that organisations use to detect malware and advanced threats by running suspicious files and code in an isolated environment before they reach the network.

What they are: Three critical flaws in FortiSandbox are currently being exploited in the wild, according to threat intelligence firm Defused Cyber. Two involve OS command injection (a flaw where an attacker can trick a system into running their own commands as if they were legitimate instructions from the software), and one is a path traversal vulnerability (where an attacker navigates outside the intended directory structure to access restricted files or functions). All three allow an unauthenticated attacker — meaning someone with no login credentials at all — to take unauthorised control of the affected system.

Who's at risk: Organisations running Fortinet FortiSandbox, FortiSandbox Cloud, or FortiSandbox PaaS on unpatched versions. CVE-2026-39813 and CVE-2026-39808 were patched in April 2026. CVE-2026-25089 was patched only last week and affects the web UI across all three product variants.

CVSS: 9.1 (Critical) for all three — patch today. Stop reading, go patch.

Root cause: The flaws exist because FortiSandbox failed to properly validate HTTP requests before acting on them. In the command injection cases, the software passed attacker-supplied input directly to the underlying operating system without sanitising it. In the path traversal case, the JRPC API did not restrict where in the file system an incoming request could reach — allowing authentication to be bypassed entirely.

Attack vector: An attacker with no account on the system sends a specially crafted HTTP request to an exposed FortiSandbox API endpoint or web UI. For the command injection flaws, the malformed request causes the server to execute attacker-supplied commands with the privileges of the FortiSandbox process. For the path traversal flaw, the crafted request navigates the API into an authentication bypass, granting access without credentials. No user interaction is required. Exploitation has been observed in the wild across all three CVEs within the past 24 hours.

Detection strategies: Check FortiSandbox logs for unexpected or malformed HTTP requests hitting JRPC API endpoints, particularly from external IP addresses. Look for anomalous process creation events on the FortiSandbox host — unexpected child processes spawned by the web service are a strong indicator. Monitor for any authentication events that do not correspond to known user accounts or sessions.

Recommended actions:

1. Upgrade FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS to the latest patched versions immediately — all three CVEs have fixes available.
2. Restrict access to FortiSandbox management interfaces to trusted IP ranges only, using firewall rules or network segmentation.
3. Enable logging on all API endpoints and set alerts for anomalous request patterns or unexpected process execution.

The FBI issued a public warning this week about a twist on cryptocurrency investment scams — also known as pig butchering (where fraudsters spend weeks or months building trust with a target before steering them toward a fake investment platform). Scammers are now dispatching physical couriers to collect cash directly from victims after legitimate banks block suspicious wire transfers.

The courier will arrive with an agreed-upon password or a specific banknote serial number to prove they are "from the platform." They are not. The money goes straight to the scammers.

The script is always the same: an online contact — met through dating apps, social media, or messaging platforms — builds a relationship, introduces a lucrative investment opportunity, and then the withdrawals mysteriously stop working. Now there's a new urgency: your account has been "flagged" and you need to hand over cash in person to fix it.

What to do: No legitimate investment platform sends a courier to your door for cash. If anyone online asks you to hand money to a stranger, stop contact immediately and report it to the FBI at ic3.gov.

The US Department of Justice has seized CFAKE and SOCFAKE — two websites hosting non-consensual AI-generated explicit images of real women, including politicians, athletes, and public figures from multiple countries. The DOJ says this is the first publicly announced domain seizure under the TAKE IT DOWN Act, a new US law criminalising the creation and distribution of non-consensual intimate deepfakes. The law gives platforms 48 hours to remove flagged content and creates a federal pathway for law enforcement to act.